Which of the following security activities is not normally a component of the operations and maintenance phase of the software development life cycle (SDLC)?
a) Vulnerability scans
b) Disposition
c) Patching
d) Regression testing